Hi Again,
This is the link and posting which best describes what to do. Going to the
link will expose the other references:
https://msdn.microsoft.com/en-us/library/aa394652(v=vs.85).aspx
The Write up of:
__InstanceOperationEvent class
The __InstanceOperationEvent system class serves as a base class for all
intrinsic
events that relate to an instance.
The following syntax is simplified from Managed Object Format (MOF) code and
includes
all inherited properties. Properties are listed in alphabetic order, not MOF
order.
Syntax
Copy
class __InstanceOperationEvent : __Event
{
uint8 SECURITY_DESCRIPTOR[];
object TargetInstance;
uint64 TIME_CREATED;
};
Members
The __InstanceOperationEvent class has these types of members:
Properties
Properties
The __InstanceOperationEvent class has these properties.
SECURITY_DESCRIPTOR
Data type: uint8 array
Access type: Read-only
Descriptor used by the event provider to determine which users can receive the
event.
This property is inherited from
__Event
.
TargetInstance
Data type: object
Access type: Read-only
Instance affected by the event. For creation events, this is the newly created
instance.
For modification events, this is the new version of the changed instance. For
deletion
events, this is the deleted instance.
TIME_CREATED
Data type: uint64
Access type: Read-only
Unique value that indicates the time at which the event was generated. This is a
64-bit value that represents the number of 100-nanosecond intervals after
January
1, 1601. The information is in the Coordinated Universal Times (UTC) format.
This
property is inherited from
__Event
.
For more information about using uint64 values in scripts, see
Scripting in WMI
.
Remarks
The __InstanceOperationEvent class is derived from
__Event
.
Instances of __InstanceOperationEvent
are not created; only instances of its subclasses are created. The following
classes
derive from
__InstanceOperationEvent:
__InstanceCreationEvent
__InstanceModificationEvent
__InstanceDeletionEvent
Overview
Just as there is a WMI class that represents each type of system resource that
can
be managed using WMI, there is a WMI class that represents each type of WMI
event.
When an event that can be monitored by WMI occurs, an instance of the
corresponding
WMI event class is created. A WMI event occurs when that instance is created.
There are three major types of WMI event classes, all of which are derived from
the
__Event
WMI class: Intrinsic Events, Extrinsic Events, and Timer Events. Intrinsic
Events,
in turn, are represented by three distinct classes derived from the
__Event class:
__NamespaceOperationEvent
, __InstanceOperationEvent, and
__ClassOperationEvent
.
Intrinsic Events
Intrinsic events are used to monitor a resource represented by a class in the
CIM
repository. Each resource is represented by an instance of a class. This means
that
monitoring a resource using WMI actually involves monitoring the instances that
correspond
to the resource.
Intrinsic events can also be used to monitor changes to a namespace or class in
the
repository. However, monitoring changes to namespaces or classes is of limited
value
to system administrators.
An intrinsic event is represented by an instance of a class derived from
__InstanceOperationEvent,
__NamespaceOperationEvent, or __ClassOperationEvent. Any changes to instances in
WMI are represented by the __InstanceOperationEvent class and the classes
derived
from it: __InstanceCreationEvent, __InstanceModificationEvent, and
__InstanceDeletionEvent.
Monitoring resources using WMI involves monitoring instances and all changes to
instances
are represented by __InstanceOperationEvent and the classes derived from it.
This
means that monitoring resources ultimately involves monitoring instances of
__InstanceOperationEvent-derived
classes.
You register interest in instances of one of these classes by issuing a
notification
query expressed in WQL. The query uses syntax similar to the following:
SELECT * FROM __InstanceOperationEventOrDerivedClass WITHIN PollingInterval
WHERE
TargetInstance ISA WMIClassName AND TargetInstance.WMIClassPropertyName = Value
For a longer discussion of using the WMI instance events to monitor computer
activity,
see
How Can I Monitor for Different Types of Events With Just One Script?
Examples
The
Monitor process event
VBScript code sample on TechNet Gallery uses __InstanceOperationEvent
to monitors the first WMI instance event for
Win32_Process
.
Requirements
Minimum supported client
Windows Vista
Minimum supported server
Windows Server 2003
Namespace
all WMI namespaces
See also
WMI System Classes
Determining the Type of Event to Receive
Writing to a Log File Based on an Event
Hi Chip,
the problem with the approach was the call for a data file as well. When
researching it yesterday the data file call is different then for a directory.
Many issues arise because some things are not exposed and the property does not
exist; the reason why that author failed...
I have attached the links for the explanations best to describe what to use
and when. I was wasting my time yesterday to write my own app for file
detection and ran into those same errors and did not post it because of other
things to do.
Using the directory call is the best, but watch out for exposing all events
and changes leads to Masking events that are done on all files when a change of
just one file happens. then you will have a very long list of change events
unless you focus on only one event...
I think the third link below is the best for I did not put these in proper
order.
Bruce
https://msdn.microsoft.com/en-us/library/system.io.filesystemwatcher.aspx?cs-save-lang=1&cs-lang=vb
http://www.go-geek.com/tips-n-tricks/monitor-directory-for-new-files-with-wsh.html
https://msdn.microsoft.com/en-us/library/aa394652(v=vs.85).aspx
https://msdn.microsoft.com/en-us/library/aa392727(v=vs.85).aspx
https://msdn.microsoft.com/en-us/library/aa394583(v=vs.85).aspx
https://msdn.microsoft.com/en-us/library/aa392727(v=vs.85).aspx
https://msdn.microsoft.com/en-us/library/aa393277(v=vs.85).aspx
https://msdn.microsoft.com/en-us/library/aa394084(v=vs.85).aspx
Sent: Saturday, January 24, 2015 12:11
PM
Subject: RE: Think I could need a bit of help...
Steve and David,
This was a great idea, but the original author had some errors in his
example code (looks like he took code from an async handler and stuffed it
into his sync example, but the objects you're dealing with either aren't the
same, or he just had errors).
Anyway, below is a working example I had done by end of the day yesterday,
which watches a specific directory for new files, using the synchronous form
of WMI calls (and WE's form of VBS converted from his WSH). It appears to
me that WE still will not work with WMI asynchronous calls (this was
something I reported long ago), which is unfortunate, but you can get
around it using this form, which polls every 5 seconds:
Option Explicit
' WE script example showing how to monitor a directory (using WMI) for file
additions
queue "monitor_dir", "\chip\"
Sub monitor_dir(ForFolder)
' uses WMI to monitor a specific directory for file additions
Dim strDrive, strFolder, strComputer, intInterval, strQuery, response,
filename
Dim objWMIService
Dim colMonitoredEvents
Dim objLatestEvent
Dim objTarget
strDrive = "C:"
' folder name must have directories separated with double back slashes
strFolder = Replace(ForFolder, "\", "\\")
strComputer = "."
intInterval = "5" ' seconds
' Connect WMI service
Set objWMIService = GetObject("winmgmts:" &
"{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
DoEvents
loadClassInformation objWMIService
' build query
strQuery = "Select * From __InstanceCreationEvent " & " Within " &
intInterval & " Where Targetinstance Isa 'CIM_DataFile'" & " And
TargetInstance.Drive='" & strDrive & "'" & " And TargetInstance.Path='" &
strFolder & "'"
' should also be able to use __InstanceDeletionEvent for file deletions?
' Execute notification query
Set colMonitoredEvents = objWMIService.ExecNotificationQuery(strQuery)
DoEvents
Do
' wait for an event
Set objLatestEvent = colMonitoredEvents.NextEvent()
DoEvents
' to see structure of received object uncomment below
' response = objLatestEvent.GetObjectText_()
' MsgBox response, vbOKOnly + vbInformation + vbMsgBoxSetForeground,
"received object"
response = ""
Set objTarget = objLatestEvent.targetInstance
response = objTarget.filename ' no path
' .name contains name with path, and .path contains only path
' now do something with the file name
queue "SpeakIt", "received " & response
Set objLatestEvent = Nothing
DoEvents
Loop
End Sub
Sub speakIt(msg)
Speak msg
End Sub
-----Original Message-----
From: Steve Clower [mailto:[email protected]]
Sent: Thursday, January 22, 2015 9:23 AM
To: [email protected]
Subject: Re: Think I could need a bit of help...
You might also take a look at the approach which takes advantage of WMI
described more here:
http://stackoverflow.com/questions/760904/how-can-i-monitor-a-windows-direct
ory-for-changes.
Steve
On 1/22/2015 9:08 AM, LBX wrote:
> Dave,
> This will check it at the 5 minute mark.
>
> Sample Format:
> StartTimer 250, "SetFocus", dObj.Control( dID )
> Your Format:
> StartTimer 50000, "CheckForState"
> Sub CheckForState()
> End Sub
>
> Sent: Thursday, January 22, 2015 6:05 AM
> Subject: Think I could need a bit of help...
>
>
> Scripters,
> In one of my projects, I need some routine to check a certain state of
> things, with given intervals. This should be done in the background,
> with as little interference with the user's activity, as possible. Let's
> for instance say, you want to check if a file has been updated, and you
> want to do that every 5 minutes, all through the day.
>
> OK, I have one idea, but wanted to know if the WE API gives a better
> solution, and if so, could someone please point me to some code or the
> like, that illustrates how to implement. Here is the idea I have, but
> not sure if it is all that waterproof, or if it holds any chance of
> malfunctioning the app.
>
> Sub CheckForState()
> Sleep 5000 'Let's just give it five seconds interval.
> ' code activity goes here...
> CheckForState()
> End Sub 'ChackForState.
>
> In other words, a simple, recursive sub, that will keep running all till
> the app closes. Yet, what if I need to end it from running, at any given
> state throughout the app execution? Like I said, not sure if this is the
> best and most smooth way to handle this task, so if anyone has a better
> idea, I am all ears.
>
> Thanks,
>
---
This email has been checked for viruses by Avast antivirus software.
http://www.avast.com
---
This email has been checked for viruses by Avast antivirus software.
http://www.avast.com
